CAPGEMINI_REGISTRATION_DOCUMENT_2017

CORPORATE GOVERNANCE - RISKS{AND INTERNAL{CONTROL

2.5 Risks and internal control

Risk management systems The Group monitors the international development of its business, focusing on countries offering satisfactory guarantees in terms of individual security and business ethics and a robust legal framework for the conduct of business, thereby limiting this risk. In addition, standard client-related risks are closely monitored: with regard to dependency, the Group has several thousand X clients, which to a certain extent enables it to resist market turbulence and reduce its exposure to volatility in certain sectors. The client portfolio consists of both a large number of entities from the public sector and a large number of entities from the private sector, from a wide spread of diversified markets. Exposure to risks of commercial dependency is therefore limited; client solvency controls during the sales process help minimize X client credit risk. In addition, the solvency of major clients, combined with the wide diversity of other smaller clients, helps reduce credit risk (see Note{19 to Capgemini’s consolidated financial statements); Furthermore, Capgemini has introduced rigorous monitoring of accounts receivable by age and a dynamic follow-up process; Capgemini pays particular attention to assessing client X satisfaction and has implemented a rigorous client relationship management process that it carries out throughout the projects. This is a key pillar of the Group's client loyalty policy, particularly for major client accounts. The Group-wide deployment of the Commercial and Contract Management function ensures operational, financial, contractual and reputation risks are monitored and mitigated throughout the contract life cycle. It focuses particularly on major, complex and high-risk contracts. This program is led by the Commercial and Contract Management Department, created in 2016, which has implemented tools, methodologies, procedures and training sessions, notably to help Production/Methods and Support Department teams manage risks. Risk analysis Despite the formal review and approval procedure for all contractual commitments given by the Group to its clients, suppliers and sub-contractors, difficulties with respect to project performance and/or project costs may be underestimated at the outset. This may result in cost overruns not covered by additional revenues, especially in the case of fixed-price contracts, or reduced revenues without any corresponding reduction in expense in the case of certain outsourcing contracts where there is a commitment to provide a certain level of service. More generally, the Group could be unable to control changes in its cost base, materially impacting the overall profitability of its operations. c. Operational risks Project performance

All new recruits are asked to undertake to comply with the principles explained in these two policies and follow an e-learning training course thereon. An organizational structure rolled-out in each country comprising an Ethics and Compliance Officer, monitors the implementation of the Ethics & Compliance Program covering all Group entities. The Group decided many years ago to only employ individuals and have commercial relations in those countries satisfying a certain number of criteria concerning business ethics and legal and physical security in the conduct of business. Since 2011, the Group has implemented a solution for measuring and monitoring conversations on Group brands on social media. Internal social media are also monitored in order to best respond to employee comments. Finally, a social media code of conduct was also drafted to strengthen governance rules covering the activities of Group employees on internal and external social media. It is freely available on the Group's website. As a listed company on the Paris Stock Exchange and a global leader in its business sector, the Group is frequently called upon by the media and the financial community to provide information on its activities. Therefore, to control and limit risks to its reputation, only persons duly authorized by Group Management are permitted to speak on behalf of the Group. The risk management systems set out below mainly encompass risks relating to employees, project performance, information systems and service continuity and significantly reduce the Group's exposure to reputation risk. Finally, the Group prepares a comprehensive crisis management plan to reduce its exposure to reputation risk in the event of a major crisis. Risk analysis Capgemini seeks to develop its market share and serves a large client base, in a wide variety of sectors and countries. The Group's biggest clients are multinationals and public bodies. The detailed list of the Group's biggest clients is strategic information and is not communicated. The contribution of the Group's main clients to Group revenues (as a percentage of total revenues) is as follows: Clients

2

{

2016

2017

Top three clients

9%

7%

Top five clients

11% 16%

10% 15%

Top ten clients

For existing clients, Capgemini is potentially exposed to standard risks: excessive dependence on a single client or group of clients or a single business sector; client insolvency; X client dissatisfaction. X

109

REGISTRATION DOCUMENT 2017 — CAPGEMINI